p28c[.]top

This domain, p28c.top, is flagged as a credential harvesting phishing site targeting users through deceptive login interfaces. Currently offline, the domain was operational until recently and exhibited infrastructure consistent with large-scale phishing operations. No specific brand impersonation has been confirmed, though the attack pattern aligns with generic credential theft campaigns. Analysis indicates the domain was created on May 26, 2026, and resolved to the IP address 154.39.104.128, hosted under AS18186 (Nebula Global LLC) in Hong Kong. The registrar of record is NameMart Pte. Ltd., a provider frequently observed in phishing domain registrations. Security vendors on VirusTotal flagged p28c.top as malicious, with 18 of 95 engines detecting it as a phishing threat. The domain appears on one security blocklist, further corroborating its classification as a high-risk asset. SSL certification was issued by ZeroSSL GmbH under the ZeroSSL RSA DV SSL CA 2 intermediate, a common choice for threat actors due to its accessibility and low validation requirements. As of the latest assessment, p28c.top remains offline, though historical DNS records and cached content suggest prior active exploitation. Organizations and users are advised to block the domain at the DNS and proxy levels to prevent accidental access. Network administrators should monitor for connections to 154.39.104.128 and review logs for prior interactions with p28c.top. Endpoint protection systems should be updated to include this domain in phishing detection rules. Given the elevated risk level, any prior exposure to this domain warrants credential rotation for potentially compromised accounts, particularly if login attempts were made during the domain's active period.